feat(server): Override PG password in dockerfile

[lan17]

Summary

• Add a Compose-level PostgreSQL password override so users can start the bundled Postgres container with a non-default password.
• Wire the same override into the server container's AGENT_CONTROL_DB_URL so the bundled server uses the matching credential by default.
• Correct the env var name to AGENT_CONTROL_POSTGRES_PASSWORD and document it in the root quickstart README.

Scope

• User-facing/API changes:
  • docker-compose.yml now supports AGENT_CONTROL_POSTGRES_PASSWORD for the bundled Postgres + server setup.
  • README.md quickstart now shows how to override the bundled PostgreSQL password.
• Internal changes:
  • Replace the hardcoded compose password with environment-variable interpolation.
  • Keep the server container DB URL in sync with the compose-managed Postgres password.
• Out of scope:
  • Rotating credentials for already-initialized Postgres data volumes.
  • Changes to docker-compose.dev.yml or direct server env var handling outside the bundled compose path.

Risk and Rollout

• Risk level: low
• Rollback plan:
  • Revert this PR to restore the previous hardcoded compose password.
  • If a deployment reused an existing Postgres volume, operators may still need to recreate the volume or manually rotate the DB user's password to match the configured env var.

Testing

• Added or updated automated tests
• Ran make check (or explained why not)
• Manually verified behavior

Manual verification performed:

• Ran docker compose -f docker-compose.yml config to verify the compose file renders correctly after the env var and quoting changes.

Why automated checks were not run:

• This PR only changes compose wiring and README documentation; no Python application code or tests were modified.

Checklist

• Linked issue/spec (if applicable)
• Updated docs/examples for user-facing changes
• Included any required follow-up tasks

Follow-up notes:

• Existing Postgres volumes keep their original credentials; changing AGENT_CONTROL_POSTGRES_PASSWORD does not retroactively rotate the database password inside an already-initialized volume.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!